Quantum Secret Sharing with Multi- level Mutually (Un-) Biased Bases 
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We construct general schemes for multi-partite quantum secret sharing using multi-level systems, 
and find that the consistent conditions for valid measurements can be summarized in two simple 
algebraic conditions. The scheme using the very high dimensional mutually unbiased bases can in 
principle achieve perfect security against intercept-resend attack; and for the scheme using mutually 
biased bases, it reaches the optimal but non-perfect security at 4-level system. We also address 
the security issue against the general attacks in the context of our multi-level schemes. Especially, 
we propose new protocol to enhance both the efficiency and the security against the entanglement- 
assisted participant's attack by incorporating quantum- key-distribution and measurement-basis- 
encrypted schemes so that its security is as robust as quantum-key-distribution. 



I. INTRODUCTION 

The security of quantum cryptography is ensured by 
the non-cloning theorem [l| so that the eavesdropping via 
physical means can always be detected. The schemes for 
quantum key distribution(QKD) and secret sharing were 
first proposed in H, [1] and [1, Q , respectively. Both of 
the schemes can be thought as the quantum version of 
the classical threshold secret sharing (fc,n)-scheme 
The scheme is designed to distribute valuable information 
among n participants so that it can be reconstructed only 
if k{< n) of them collaborate (isj . 

Although the quantum secret sharing(QSS) scheme is 
better than the classical one in detecting the error caused 
by an eavesdropper, it is not perfect. For the common 
intercept-resend attack, an eavesdropper can get hold of 
some participants' particles, perform the Bell-state mea- 
surement jlSj and resend back. The probability of de- 
tecting such an attack is only 25 percent for the QSS 
scheme @ using 2-level system. The detecting rate is 
quite low if the secret sharing is for some fatal event such 
as the release of warheads, for which we hope to have the 
perfect security, i.e., 100 percent detecting rate. There- 
fore, an important question for QSS is whether one can 
have a scheme with the perfect security for attacks such 
as intercept-resend. Surprisingly, despite many modified 
QSS schemes inspired by the original works [6, 7] in the 
past few years, as far as we know, there is no discussion 
for such an issue, even in principle. 

One straightforward way to increase the detecting rate 
against the attacks is to use higher dimensional quan- 
tum systems to proceed the QSS. Intuitively, increasing 
the dimensions of the quantum bases will complicate the 
QSS protocol so that the eavesdropper has more difhculty 
to obtain correct information without being detected. 
Of course, we will pay the price for reducing the effi- 
ciency because we now use the higher dimensional bases 
to encode one bit information. This may also complicate 
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the consistent conditions for the valid measurements of 
the protocol and make the QSS procedure more tedious. 
Moreover, the complication of the protocol may again 
pose security issues. 



In this article we construct the QSS schemes using d- 
Icvcl systems and establish a security benchmark as a 
function of d against the common intercept-resend at- 
tack. The results show that in principle the perfect se- 
curity against such an attack can be achieved by using 
very high dimensional mutually- unbiased bases(MUBs). 
Interestingly, we may wonder if the security or error- 
detecting rate will always increase by using the higher 
dimensional system. We will see that this is subtle, and 
we find a counterexample by using the mutually-biased 
bases(MBBs) for QSS, which reaches non-perfect opti- 
mal security at 4-level s^^stem. Our multi-level scheme 
is the generalization of 6] for 2-level case. It turns out 
that the consistent conditions for valid measurements of 
the higher dimensional protocol is quite simple and nat- 
ural, and can be summarized in two algebraic conditions. 
Moreover, regarding the recent concern on the security of 
QSS [l3|, we will also address the issue in our multi- level 
schemes against more general and efficient attacks other 
than intercept-resend. We find that one can invalidate 
the entanglement-assited participant's attack devised in 
by slightly modifying the protocol proposed in ^6|] . 



The paper is organized as follows: In the next section 
we will construct the QSS schemes by using the MUBs 
and MBBs, respectively. In section III we establish a 
security benchmark against the intercept-resend attack. 
In section IV we consider the security of our schemes 
against more general attacks. Especially, we give a proof 
of security against the attack by an outsider Eve with en- 
tangled probe. However, we comment that the original 
scheme [6| is vulnerable to the the entanglement-assited 
participant's attack devised in [3]. Finally we conclude 
our paper in section V by proposing an 100 percent ef- 
ficient scheme against the entanglement-assited partici- 
pant's attack by combining the quantum- key-distribution 
and measurement-basis-encrypted method. 
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II. QUANTUM SECRET SHARING WITH 
MUTUALLY UNBIASED BASES 



We first consider the (2, 3)-scheme for QSS using the 
multi-level MUBs, and later generalize it to the multi- 
partite cases. The (2,3)-scheme is for Alice to distribute 
the secret key to both Bob and Charlie, and proceed 
the QSS protocol via the local operations and classical 
communication(LOCC). 

We start with the d- level GHZ state ^ , which is shared 
among Alice, Bob and Charlie, 
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each holds one particle in it. The GHZ state is a max- 
imally entangled state, and is used for QSS such that 
the measurement outcomes of Alice, Bob and Charlie for 
their own particles are correlated. Once Bob and Charlie 
combine their outcomes of measurements, they can know 
Alice's. 

A typical QSS protocol runs as following (i) 
Alice prepares the GHZ state, and then distributes the 
corresponding particles to Bob and Charlie, respectively, 
(ii) Alice, Bob and Charlie perform the local measure- 
ments on their own particles by randomly choosing the 
measurement bases, (iii) Bob and Charlie then announce 
their measurement bases publicly to Alice, but not their 
outcomes, (iv) Alice then determines if the measurement 
bases satisfy the consistent conditions encoded by the 
GHZ state, which can be summarized in a lookup table. 
If so, they keep the outcomes as the useful key and ex- 
amine further if there is eavesdropping. If there is, then 
just discard the results, (v) Repeat the above procedure 
to collect enough outcomes for the secret information. 
When necessary. Bob and Charlie can collaborate to re- 
produce Alice's information. 

We will adopt the above protocol for the QSS using d- 
level GHZ state ([T]). However, in the end we will modify 
this protocol to enhance both the security and efficiency 
of QSS. The modification will incorporate both QKD and 
measurement-basis-encrypted scheme [l^ . 

As noted in [13, HH, it is possible to find d+1 MUBs 
in d dimensions only if d is (any power of) an odd prime. 
Besides the canonical basis {\j),j = 0,...,d— 1}, the 
explicit forms of the remaining d sets of MUBs are 



\Pn) = 



Vd^ 



3=0 



\3). ^=^i (2) 



where P (runs from 1 to d) denotes the basis and p (runs 
from to d — 1) labels the vector in a given orthonor- 
mal basis p^ . They are mutually unbiased because the 
overlap is 



\{Pp\P'') 
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for P + P', 



(3) 



which follows from the Gauss sums of number theory 
valid for odd prime d. 

From ([3]) we can derive the consistent condi- 
tions for a valid measurement. To arrive that, 
let us assume that Bob and Charlie hold the 
states \Bb) = ^ E ,to lj> and \C,) = 

73Ej=oe^'^('^^'+'=j)|j), respectively. Then, take the in- 
ner product between the GHZ state and the 2-particle 
state \Bb)\Cc)^ we obtain 
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which after normalization should match with Alice's state 
\Aa) = ■^Y!^Zle"f'^^^''+''3^\j) in order to make a valid 
measurement for secret sharing. This then implies the 
following consistent conditions: 



A + B + C = (mod d), 
a + 6 + c = (mod d) . 



(4) 
(5) 



According to these, we can write down ad^ xd^ lookup 
table for the use of QSS protocol using the d-level system. 
This is the straightforward generalization for the d = 2 
case. In QSS protocol HQ, one first checks if condition 
(III) satisfies or not by LOCC. If yes, it is a valid measure- 
ment and ([5]) follows; otherwise, the measurement will 
be discarded. Importantly, the conciseness of conditions 
(j4|) and ^ helps to simplify the practical en/de-coding 
procedures in QSS. On the other hand, condition (j4]) im- 
plies that the efficiency is 1/d since only one out of d 
cases makes a valid measurement, and condition ([5]) can 
be used to detect eavesdropping for valid measurements. 

Quantum secret sharing with mutually biased bases. — 
The above generalizes the QSS scheme of [1, Q using 
MUBs. Now we look for the scheme using MBBs which 
has not been discussed before in literatures. 

Our construction of the d-level MBBs for QSS is as 
follows. Start with the Fourier transform of the canonical 
basis 
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We then introduce the following d MBBs 
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for P = 0, ..,d- l,p = 0, 1. Note that \0j) = 

\uj)F- For simplicity, here and hereafter we use the same 
notation as for MUBs. 

We now show that these bases will form a consistent 
lookup table for QSS. Note that the overlap 
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Thus, each basis {\Pp),p = 0,..,d— 1} is orthonormal 
and complete, and the overlap \{Pp\Pp,)\ between differ- 
ent bases will depend on P' — P and so is called biased 
except for d = 3 case, which is the same as d = 3 MUBs'. 

Similar to the case for MUBs, if Bob and Charlie hold 
the states \Bb) = |u6)f + -^{e'^"^ - 1)|0) and \Cc) ^ 
\uc)f + '^{^^'"'^ ~ respectively, we should require 
the state (CcDIGiJZs) to match Alice's state \Ao) = 
\ua)p + -^(e*'^"^ — 1)|0) for a valid measurement. This 

then yields the same consistent conditions ^ and ([5]) for 
a valid measurement as for MUBs. 

It is straightforward to generalize the above tri-partite 
scheme to the multi-partite one. We just start with the 
n-partite GHZ state 

^ d-\ 

|Gi/Z„) =--=^|jJJ...j)l23...n. (8) 

Each party measures her/his own particle and obtains 
the outcome in one of the d bases, say {|-Pp)}. To have 
a consistent lookup table for n-partite case, we should 
require (up to some normalization factor) 

\Aa) - ((Sb|(Ce|(i?rf|---(r!c.|)|Gi/Z„) 

which yields the following consistent conditions 

A + B + G+... + f7 = 0(modd), (9) 
a + 6 + c+ ... + cj = (mod d). (10) 

These are straightforward generalization of ^ and ([5]), 
respectively. Note that because of ([3]) or condition 
^ implies (jTU]) but not vice versa. 



III. DETECTING THE INTERCEPT-RESEND 
ATTACK 

We like to give a benchmark formula for the detecting 
rate against the very common intercept-resend attack as 
a function of dimension d. The attack goes as follows for 
tri-partite case: the dishonest Charlie* gets hold of Bob's 
particle and performs the general Bell-state measurement 
on his two-particle state, then resends one particle to 
Bob. Since Charlie* does not know Alice's measurement 
basis, he may use the wrong base for his Bell-state mea- 
surement but still has some probability to get the right 
result. On the other hand, if Charlie* happens to use 
the right base, he will then know Bob's measurement 
outcome and then Alice's after LOCC without making 
detectable error. 

The detecting rate against the attack can be de- 
rived as follows. Let us assume that Alice's mea- 
surement outcome is |v4a). However, Charlie* thinks 
Alice was using the base {|^^/)} and expands his 
two-particle state in such a base, i.e., {Aa\GHZ-ii = 
Ea~io(^'il^a')(^a'|G'i?^3)- A detectable error occurs 



if the condition ([4]) holds but (O is violated, and its rate 
is 1 — Then, the average detecting rate over 

the configurations satisfying (j4]) but not ([5]) is 

P^--= E ^El(^'^K')P(l-|«'l^a)P). (11) 
A-A' = \ a'=0 

For the scheme using MUBs, by ^ the detecting rate 
dm) is 

PEMVBs{d) = {^-^f- (12) 

It is a monotonically increasing function of d so that 
higher dimensional system is more secure. Especially, it 
approaches unity as d goes to infinity and implies perfect 
security, in principle. 

For the cases using MBBs, by (O we find that 

PE.MBBs{a) ^ — . (13) 

In contrast to MUBs' case, it is not a monotonic function 
of d because of the weighted overlap between bases. In- 
stead, it reaches the maximal at d = 4 with PE,MBBs{d = 
4) = i|, and then decreases to zero monotonically for 
d > 4. Moreover, PE,MUBs{d = 3) = PE,MBBs{d = 
3) = I as expected because our MUBs and MBBs are 
the same for d = 3. Recall that the detecting rate for the 
2-level scheme of Q is only 1/4, so even the lower d{> 2) 
schemes using MBBs have higher security than the 2- 
level case. Since the MUBs' scheme is only available for 
odd prime d, the d = 4 MBBs' case can be considered as 
the optimal scheme for a compromise between the degree 
of security and the efficiency. Practically, one can phys- 
ically realize the d = 4 system by combining two 2-level 
systems to carry out the optimal MBBs' scheme; for ex- 
ample, the para- and ortho-helium spectra can be seen as 
a. d — A system by appropriately adjusting the external 
magnetic/electric fields. 

Estimating the detecting rate in the multi-partite sys- 
tem is more complicated, we will not discuss the details 
here. However, the more persons share the entangled key, 
the more difficult it is for the eavesdropper to collect all 
the other's particles and the more secure the scheme is. 



IV. SECURITY AGAINST GENERAL 
EAVESDROPPERS 

Enforcing the security of the cryptography is state-of- 
the-art, so is its attack strategy. After establishing a se- 
curity benchmark against the common intercept-resend 
attack, we like to address the issue for more general at- 
tacks which could be more efficient than expected for an 
eavesdropper (called Eve) using the ancilla probe. 

First, we consider the case that Eve is not the member 
sharing the secret via GHZ state. Then, the QSS scheme 
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is secure provided that GHZ state is the only state satis- 
fying the consistent conditions ^ and pU|) . Otherwise, 
there will be a set of fake key states {ji^iiT)} other than 
the GHZ satisfying ^ and PH)) . and Eve can use the an- 
cilla states {\E)pk} and \E)chz to form the entangled 
state 

\^) ^\GHZr,)\E)GHZ+ \FK)\E)fk. (14) 

{\FK)} 

She can then extract the encoded secret information in 
the GHZ state by performing the general Bell-state mea- 
surement without making detectable errors. We now 
show that GHZ state is indeed the unique one satisfy- 
ing ([9]) and (fTO|. 

The proof constructed for the 2-level scheme is given 
in ^ by showing that all the states orthogonal to the 
GHZ state do not satisfy the consistent conditions Q 
and (fTO)) . This procedure will be far more involved for 
the multi-level case. Instead, we directly show 

|(A|<i>)|<|(A|Gi/Z„)| (15) 

for any state |$) belonging to the vector space V^f^^ 
which is orthogonal to GHZ state, and the conditional 
states |A)'s representing the consistent conditions ^ and 
(Uni), i.e., 

|A) = \Aa)\Bb)\a)...\n^), 

with the states' labels satisfying © and ^TU\i . This im- 
plies that none of the states in Vq^^ will satisfy all the 
conditions given by ^ and (HO]). The state |*) 
in (|14p will then reduce to the product of GHZ and an- 
cilla states so that Eve cannot obtain useful information 
through entanglement without making detectable errors. 

We start the proof by constructing the basis vectors 
for Vqjjz in terms of the canonical basis {\ijk- ■ ■)} via 
Gram-Schmidt orthonormalization process. Then, there 
arrive two kinds of basis states: (1) there are — d unit 
vectors in the canonical basis which do not belong to the 
subset made of GHZ state, i.e., 

■■=\i]k---)^\m.---) 

with i, j, /c, ^ . • . = 0, 1, 2, . . . , d— 1; (2) there are the other 
d — 1 basis vectors taking the following form 

and the orthogonality to GHZ state requires X] j=o '^i ^ ^ 
besides the normalization condition X]j=o I'^jl^ ~ ^■ 

Before we check if states and |<1')_l,2 satisfy ([TS]), 

we note that 

(Abjj---> -rf"* (16) 
for any conditional state |A) so that 

(A|GffZ„) (17) 



These two imply that while checking ((T5)) we can treat 
all the conditional states equally, it then helps to 

simplify the task. Condition (fT6|) then yields (A|$)j^^2 = 

'^"^ Sj=o "-J ~ ^O'' ^'^y I A) second type of 

basis vectors are orthogonal to all the conditional states 
and thus are excluded from the set {\FK)} in ([T^ . On 
the other hand, from (fT7|) for the first kind of basis vec- 
tors we have |(A|$)_l_i| = d~^ < {A\GHZn) for any 
conditional state |A) so that they are also excluded from 
the set in lfT4|) . This then completes our proof. 

However, the uniqueness of GHZ state does not guar- 
antee QSS' security if Charlie* is dishonest with the help 
of an ancilla Eve to entangle with Bob's particle. This 
is the entanglement-assisted participant's attack. In p^ . 
an explicit attacking scheme via manipulating GHZ state 
with ancilla was devised so that AB's and CE^s states 
are maximally entangled [20j 

d-l 

\^)abce = ^ E I^") I^'') ® \^if^)cE (18) 

a,b=0 

where the bar quantity means its value is chosen and 

fixed, and {|V'i^^'')c£;} is an orthonormal complete set 
for Alice's and Bob's chosen basis A and B, respec- 
tively. After Alice and Bob measure their particles in 
bases A and B with the outcomes a = a and b = b re- 
spectively, then the state (flSj) collapses to \^p'"^^^)cE■ 

Since {|'0l&^^')c£;} is orthonormal and Charlie* knows 
Alice's and Bob's measurement basis, he can perform lo- 
cal unitary transformations to extract the d and b from 

IV^^^^)c£; without making detectable error as shown in 
|1J |. In a sense, the multi- level QSS scheme using proto- 
col of 0] is highly insecure. 

V. AN EFFICIENT SCHEME AGAINST 
ENTANGLEMENT-ASSISTED PARTICIPANT'S 
ATTACK 

We now propose a modified protocol to remedy the 
above security loop-hole. Moreover, it will enhance the 
efficiency of QSS from l/d to 100 percent. The modi- 
fication is two-fold. One is to adopt the measurement- 
basis-encrypted efficient QSS scheme proposed in [l^ as 
follows: Instead for the participants to announce their 
measurement basis in order to verify if they satisfy © for 
the valid measurements, they will use their measurement 
outcomes as the measurement basis for the next run. As 
long as the first run is a valid measurement, then all the 
subsequent runs will be automatically the valid measure- 
ments as seen from © and ([TU)) . This yields 100 percent 
efficiency. Moreover, since Charlie* does not know about 
others' chosen bases and thus cannot take advantage of 
the entangled state (US]), he has no way to extract other's 

measurement outcomes from such a state |V'i^^^)c-E. By 
guess, he has only 1/d chance to do it right. The remain- 
ing modification is to ensure the first run can be a valid 
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measurement without announcing the measurement ba- 
sis. This can be done by using multi-level QKD for Alice 
to distribute a valid set of measurement basis to each 
participant separately. The eavesdropper can of course 
attack QKD, too. However, the QKD security is more 
robust than QSS's and has been studied extensively, e.g. 
see [l^ . An alternative against the attack of is con- 
sidered in for multi-level QSS recently. 

In this paper, we have generalized the QSS scheme 
for qubits to the multi-level cases with both MUBs and 



MBBs. We also discuss the security issues for general 
attacks. Finally we propose an efficient and secure pro- 
tocol which could be relevant to the physical realization 
of QSS. 
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